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REMARKS 

Applicant respectfully requests reconsideration of the instant application in view 
of the preceding amendments and/or the following remarks. No claim amendments have been 
made and Applicant submits that no new matter has been added by way of this Response. 
Claims 1-15 and 21-26 are currently pending. 

Specification 

The Examiner has objected to an alleged informality in the specification. 
Specifically, the Examiner has suggested that the specification be updated at [0008] to reflect 
the maturation of application number 10/243,489 into patent number 7,359,966. Applicant has 
amended [0008] of the specification to indicate the new status of the patent. Accordingly, 
Applicant submits that the Examiner's objection to the specification has been overcome. 

Rejections under 35 U.S.C. § 103 

Claims 1-15 and 21-26 have been rejected under 35 U.S.C. § 103(a) as allegedly 
being unpatentable over Vaidya (US Patent No. 6,279,113; hereinafter, "Vaidya") in view of 
Borer (US Patent No. 6,057,892; hereinafter, "Borer"). Applicant respectfully traverses the 
Examiner's rejections and submits that a prima facie case of obviousness has not been 
established and that the pending claims are patentably distinct from the cited references, taken 
alone or in combination, for at least the following reasons. 

MPEP § 706.02(j) prescribes that a rejection under 35 U.S.C. § 103 should set 

forth: 

(i) the relevant teachings of the prior art relied upon, 

(ii) the differences in the claim over the applied references, 

(iii) the proposed modification of the applied references to 
arrive at the claimed subject matter, and 
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(iv) an explanation as to why the claimed invention would 
have been obvious to one of ordinary skill in the art at the time 
the invention was made. 

Applicant submits that the rejections in the pending Office Action do not 
establish each of these requirements. 

Applicant submits that, by over-generalizing cited references, the rejections in 
the July 16, 2008 Office Action do not establish at least either of the first two elements of a 
prima facie case of obviousness. Independent claim 1 recites, inter alia, 

1. A method of reducing spread of data on a network, comprising: 

for each pair of sending node and receiving node, marking 
transmissions of data packets for said pair as marked transmissions 
when said spectral analysis indicates peak frequencies associated 
with said marked transmissions are different from peak frequencies 
associated with others of said transmissions for said pair over a 
window of a predetermined number of said time periods; 

interrupting traffic of said future data packets based on said 
estimating. 

By way of example only, Applicant submits that none of the cited references, 
taken alone or in combination, discuss or render obvious at least these elements of independent 
claim 1. For example, the pending rejection has cited to col. 7, lines 12-24; col. 8, lines 1-15 
and 40-56; col. 9, lines 3-20; and col. 11, lines 16-32 of Vaidya as allegedly discussing the 
claim element "for each pair of sending node and receiving node, marking transmissions of data 
packets for said pair as marked transmissions when said spectral analysis indicates peak 
frequencies associated with said marked transmissions are different from peak frequencies 
associated with others of said transmissions for said pair over a window of a predetermined 
number of said time periods," recited in independent claim 1 (July 16, 2008 Office Action, p. 3, 
^1 1). Applicant respectfully traverses this argument and submits that the pending rejection has 
overgeneralized the reference and that neither the cited portions of Vaidya, nor indeed the rest 
of the reference, discuss or render obvious at least this claim element. Instead, Vaidya 
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discusses "[a] signature based dynamic network intrusion detection system (IDS) including] 
attach signature profiles which are descriptive of characteristics of known network security 
violations." (Vaidya, abstract). Vaidya's system includes "monitoring network data" and 
extracting information from data packets, such as "MAC header information, IP header 
information, transport header information, and application information." (Vaidya, col. 7, lines 
12-24). The extracted data is compared with attack signature profiles in order to detect 
intruding data packets. Vaidya does not, however, discuss or render obvious, " peak 
frequencies associated with said marked transmissions are different from peak frequencies 
associated with others of said transmissions," as recited in independent claim 1. In fact, 
Vaidya never even mentions "frequencies" at all, particularly not with reference to data packets. 

In another example, the pending rejection has cited col. 10, lines 3-16 and col. 
12, lines 1 1-42 of Vaidya as allegedly discussing the claim element, "interrupting traffic of said 
future data packets based on said estimating," as recited in independent claim 1 (July 16, 2008 
Office Action, p. 3, ^ 4). Applicant respectfully traverses this argument and submits that the 
pending rejection has overgeneralized the reference and that neither the cited portions of 
Vaidya, nor indeed the rest of the reference, discuss or render obvious at least this claim 
element. Vaidya simply does not discuss "interrupting traffic of said future data packets," as 
recited in the claim. For example, the cited portions of Vaidya describe detection of 
time/counter-based sequential attacks by monitoring events associated with an application 
session, comparing events to evaluated expressions associated with a timer/counter-based 
sequential attack profile, and entering timestamps in a state cache until a threshold number of 
timestamps have been added to register an intrusion detection. This is not interruption but 
detection, and at no time does Vaidya's intrusion detection system ever discuss or render 
obvious, "interrupting traffic of said future data packets," as recited in independent claim 1 . 
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The MPEP prescribes that, "when evaluating the scope of a claim, every 
limitation in the claim must be considered" [§ 2106 11(C), emphasis added] and, "All words in a 
claim must be considered in judging the patentability of that claim against the prior art." [§ 
2143.03, emphasis added]. Applicant submits that, by overgeneralizing references, the 
pending rejection fails to consider "all words in [the] claim," as required, for example, by 
MPEP § 2143.03. Applicant further submits that Vaidya does not discuss or render obvious at 
least the claim elements discussed above. Nor does Borer, which describes motion correlation 
in image sequences, remedy the deficiencies identified above with respect to Vaidya. 
Accordingly, Applicant respectfully requests reconsideration and withdrawal of this basis of the 
Examiner's rejection. Should the Examiner disagree, Applicant respectfully request that the 
Examiner provide clarification as to how he believes the references allegedly discuss "for each 
pair of sending node and receiving node, marking transmissions of data packets for said pair as 
marked transmissions when said spectral analysis indicates peak frequencies associated with 
said marked transmissions are different from peak frequencies associated with others of said 
transmissions for said pair over a window of a predetermined number of said time periods," 
and, "interrupting traffic of said future data packets based on said estimating," as recited in 
independent claim 1 . 

Furthermore, Applicant submits that the rejections in the July 16, 2008 Office 
Action have not established why the claimed invention would have been obvious to one of 
ordinary skill in the art at the time the invention was made by proposing a combination of 
incompatible references and by not providing a discussion of the level of ordinary skill in the 
art. 

MPEP 2143. 01(V) prescribes that, "[i]f proposed modification would render the 
prior art invention being modified unsatisfactory for its intended purpose, then there is no 
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suggestion or motivation to make the proposed modification." Vaidya discusses "[a] signature 
based dynamic network intrusion detection system (IDS) including] attack signature profiles 
which are descriptive of characteristics of known network security violations," (Vaidya, 
abstract), while Borer discusses a motion correlation technique for "analyzing movement in 
image sequences" (Borer, abstract). Applicant submits that the cited references are 
incompatible and that a combination of the references, if such a combination were even 
possible, would render each reference unsuitable for its intended purpose. By way of example 
only, Applicant notes that Vaidya's system "monitors network traffic" to detect data packets 
containing information matching attack signature profiles (see Viadya, abstract). Analyzing 
such data packets by Borer's system, if such an analysis were even possible, would render 
Borer's system unsuitable for it's stated purpose of "motion correlation" for "analyzing 
movement in image sequences" (Borer, abstract), as the network data packets described in 
Vaidya have no relation to motion in image sequences. Similarly, Applicant notes that Borer's 
system uses spatio-temporal discrete Fourier transforms to correlate images and thereby discern 
motion in image sequences (see Borer, abstract). Such Fourier transforms would have no 
place in Vaidya's system, which detects network intrusions by comparing data packet 
characteristics such as header data to attack signature profiles. It is not clear how the spatio- 
temporal Fourier transforms of Borer could even be applied to the network data packets in 
Vaidya's system. Accordingly, for at least the reasons stated above, Applicant submits that a 
prima facie case of obviousness has not been established and respectfully requests 
reconsideration and withdrawal of the rejection. 

Applicant also submits that the pending rejection has provided no indication of 
the level of ordinary skill in the art. MPEP § 2141 (II)(C) states, "Any obviousness rejection 
should include, either explicitly or implicitly in view of the prior art applied, an indication of 
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the level of ordinary skill." The pending rejection refers to, "one of ordinary skill in the art," 

(July 16, 2008 Office Action, p. 4, % 2) but has provided no indication or discussion of which 

art is described or the level of ordinary skill associated therewith. The rejection's reference to 

"the art" is overly general and, consequently, does not provide a specific indication of the level 

of ordinary skill pertinent to the claimed subject matter. MPEP § 2141 .03 (III) states, "The 

importance of resolving the level of ordinary skill in the art lies in the necessity of maintaining 

objectivity in the obviousness inquiry." Applicant submits that impermissible hindsight has 

been applied in asserting obviousness of the various claim elements without providing an 

indication of the level of ordinary skill. As such, Applicant respectfully requests that, if the 

Examiner maintains this rejection, the Examiner discuss the level of ordinary skill in the art at 

the time of the invention and clarify how the claimed subject matter would have been obvious 

to one possessing that level of skill. 

Although of different scope than claim 1 , Applicant submits that claim 8 is 

patentable over Vaidya in view of Borer for at least similar reasons as discussed above 

identifying deficiencies in both Vaidya and Borer with regard to independent claim 1 . For 

example, claim 8 recites, inter alia: 

A method of reducing spread of data on a network, comprising: 

comparing peak frequencies in successive ones of said 
periodograms for said sender node to determine if one of said 
periodograms includes a peak above a threshold at a frequency 
different from saif peak frequencies in a preceding one of said 
periodograms; 

interrupting traffic of said future data packets corresponding to 
said frequency based on said estimating. 

Applicant respectfully submits that at least these claim elements from independent claim 8 are 

not discussed or rendered obvious by Vaidya, which discusses detecting network intrusions 
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based on attack signature profiles, nor by Borer, which discusses motion correlation in image 

sequences, taken alone or in combination. 

Although of different scope than claim 1, Applicant submits that claim 12 is 

patentable over Vaidya in view of Borer for at least similar reasons as discussed above 

identifying deficiencies in both Vaidya and Borer with regard to independent claim 1 . For 

example, claim 1 2 recites, inter alia: 

A method of reducing spread of data on a network, comprising: 

comparing successive periodograms for said sender node to 
determine when at least one new peak above a threshold is present 
in one of said periodograms; 

interrupting traffic of said data packets corresponding to said at 
least one new peak based on said estimating. 

Applicant respectfully submits that at least these claim elements from independent claim 12 are 

not discussed or rendered obvious by Vaidya, which discusses detecting network intrusions 

based on attack signature profiles, nor by Borer, which discusses motion correlation in image 

sequences, taken alone or in combination. 

Although of different scope than claim 1, Applicant submits that claim 21 is 

patentable over Vaidya in view of Borer for at least similar reasons as discussed above 

identifying deficiencies in both Vaidya and Borer with regard to independent claim 1 . For 

example, claim 21 recites, inter alia: 

A computer program, disposed on a computer-readable medium, 
for reducing spread of data on a network, said computer program 
including instructions for causing a processor to: 

for each pair of sending node and receiving node, mark 
transmissions of data packets for said pair as marked transmissions 
when said spectral analysis indicates peak frequencies associated 
with said marked transmissions are different from peak frequencies 
associated with others of said transmissions for said pair over a 
window of a predetermined number of said time periods; 
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interrupting traffic of said future data packets based on said 
estimating. 

Applicant respectfully submits that at least these claim elements from independent claim 21 are 
not discussed or rendered obvious by Vaidya, which discusses detecting network intrusions 
based on attack signature profiles, nor by Borer, which discusses motion correlation in image 
sequences, taken alone or in combination. 

Furthermore, Applicant submits claims 2-7, 9-11, 13-15 and 22-26, which are 
directly or indirectly dependent from independent claims 1,8, 12 and 21, are also not discussed 
or rendered obvious Vaidya, which discusses detecting network intrusions based on attack 
signature profiles, nor by Borer, which discusses motion correlation in image sequences, taken 
alone or in combination., for at least similar reasons to those discussed above. 

Accordingly, Applicant requests withdrawal of this ground of rejections. 
Conclusion 

In summary, Applicant submits that independent claims 1, 8, 12 and 21 are 
patentably distinct from the cited reference for at least the reasons discussed above. Applicant 
submits that claims 2-7, 9-11, 13-15 and 22-26, which are directly or indirectly dependent from 
independent claims 1,8, 12 and 21, are also patentably distinct from the cited reference for at 
least the reasons discussed above. 

As Applicant's remarks with respect to the Examiner's rejections are sufficient 
to overcome these rejections, Applicant's silence as to assertions by the Examiner in the Office 
Action or certain requirements that may be applicable to such rejections (e.g., whether a 
reference constitutes prior art, ability to combine references, assertions as to patentability of 
dependent claims) is not a concession by Applicant that such assertions are accurate or such 
requirements have been met, and Applicant reserves the right to analyze and dispute such in the 
future. Furthermore, Applicant submits that the originally filed claims are patentably distinct 
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from the cited reference. As such, Applicant reserves the right to pursue the originally filed 

claims, as well as claims directly or indirectly dependent on originally filed claims, in one or 

more continuation application(s). Accordingly, Applicant respectfully requests 

reconsideration/further examination of the instant application in view of the foregoing 

Amendments/Remarks. 
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AUTHORIZATION 

The Commissioner is hereby authorized to charge any additional fees which may 
be required for consideration of this Amendment to Deposit Account No. 03-1240, Order No. 
19161-620. 

In the event that an additional extension of time is required, or which may be 
required in addition to that requested in a petition for an extension of time, the Commissioner is 
requested to grant a petition for that extension of time which is required to make this response 
timely and is hereby authorized to charge any fee for such an extension of time or credit any 
overpayment for an extension of time to Deposit Account No. 03-1240, Order No. 19161-620. 

Respectfully submitted, 
Chadbourne & Parke LLP 

Dated: October 16, 2008 By: /Walter G. Hanchuk/ 

Walter G. Hanchuk 
Registration No. 35,179 

Chadbourne & Parke, L.L.P. 
30 Rockefeller Plaza 
New York, NY 10112 
212-408-5100 Telephone 
212-541-5369 Facsimile 



21 



